CVE-2026-124409 · Package
NO FIX YET
The CURCY multi-currency plugin for WooCommerce is missing an authorization check, so access control can be bypassed through misconfigured permission levels. The description says affected versions run through 2.2.21, and the sources give no further detail on what an attacker can read or change.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the CURCY (woo-multi-currency) WooCommerce plugin from VillaTheme at or below 2.2.21 are in scope. The sources do not describe which endpoints or roles are involved, so whether anonymous users can reach the flaw is unknown.
Not affected if plugin-not-installed
Who cares woo-multi-currency, woocommerce, wordpress
woo-multi-currency.php.2.2.21 as in scope.No fix yet, per the sources.
Missing Authorization vulnerability in VillaTheme CURCY woo-multi-currency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CURCY: from n/a through 2.2.21.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.